Selected work
Each project states the problem, the constraints, the decisions and what each one cost, and where it ended up.
Each project has a full case file. Expand below, or press / and run cat bystander.
-
CarInfo
Vehicle research platform over a 28,000-vehicle EPA dataset with NHTSA safety enrichment.
Caught an import bug misclassifying 419 plug-in hybrids, causing 60–70% valuation errors. Found by checking output against expectations rather than trusting the import.
case study
- Public vehicle data is spread across federal datasets of differing shape and quality. Merging them naively produces confident-looking numbers that are wrong.
-
- Source data has classification inconsistencies that are not flagged.
- Ownership-cost modelling is regional. A national average misleads.
- A research tool that shows a wrong number without signalling uncertainty is worse than one showing nothing.
-
-
Provenance and trust system
Every field is labelled verified, curated, or estimated. Surface confidence rather than laundering it.
-
Ownership-cost model recalibrated to Ontario assumptions
Regional assumptions live behind one centralized config.
-
UI redesign across 15 routes and 25+ components
Three-tier progressive disclosure.
-
- Live, open source, with per-field trust levels visible to the reader.
-
Bystander
Emergency response assistant built in 36 hours.
case study
- A bystander at an emergency does not know what they are looking at or what to do first.
-
- 36 hours.
- Four people.
- A live demo at the end.
- A hard dependency on APIs nobody had used before.
-
-
8-second video scene analysis returning a 1–10 severity score
Built on the Gemini API with a deliberately bounded window, because unbounded video is slow and unreliable under demo conditions.
-
Frontend and backend split so the team could parallelize
Splitting the surfaces let the vitals and alerting work proceed independently of mine.
-
- Shipped and demoed in 36 hours, and won the named award.
-
TimeVault
Records platform over 57,000+ WWI military records.
case study
-
-
Three roles enforced through JWT
Admin endpoints return 401 without a token and 403 without the role. The distinction is deliberate: 401 answers who are you, 403 answers you are known and still not allowed.
-
API request log behind an admin view
Records method, path, status, and latency on every call, indexed descending by timestamp for recency reads, with a hook that no-ops so un-migrated databases still run.
-
Recharts dashboards behind role-based access
Reporting surfaces are gated by the same role check as the admin endpoints.
-
-
-
Mizan
Personal wealth and asset tracker with a rules-based calculation engine.
case study
- Wealth-obligation calculation under a specific ruleset requires tracking assets over a lunar year, applying threshold tests, and screening holdings against structural criteria. The domain is Islamic wealth calculation, or zakat. A spreadsheet is error-prone and loses history.
-
- One developer, no budget for paid services.
- Correctness outranks features. A wrong number is worse than a missing one.
- The rules are not arbitrary. They must be encoded faithfully and stay testable in isolation.
-
-
Pure calculation core with zero I/O
A dependency-free module covered by Vitest across threshold, holding-period, and screening logic.
-
Authorization by construction, not by check
Every update and delete matches on both record ID and owner ID, so a guessed UUID cannot reach another account. Not a middleware guard a future handler might forget: it is in the query itself. I have found this exact vulnerability class twice in production systems, once while auditing my own shipped feature. This is the design that prevents it.
-
Sessions hashed at rest
bcrypt for passwords, and session tokens stored as SHA-256 behind httpOnly cookies.
-
No expiring dependencies on critical paths
Every critical path runs locally, so no feature dies when a third-party trial lapses. That includes a self-contained calendar converter rather than an external service.
-
Three-layer split
Server components, user-scoped REST handlers, and a dependency-free logic core.
-
- Live and open source. The engine is testable without a database, and the authorization model has no reachable cross-account path.
Systems and data structures coursework
- BFS, DFS, and Dijkstra's shortest path over adjacency matrices and adjacency lists (C).
- Expression trees, a max-heap, an RPN stack calculator, and a binary-file record manager (C).
- Manual memory management with pointers. Segmentation faults and leaks debugged with gdb.
- Investment portfolio manager with buy/sell logic, fee handling, and multi-field search (Java).
- Discussion board with registration, posts, and polls persisted through file I/O (Java).